Remove strlower_m() and strupper_m() from source4 and common code.

This function is problematic because a string may expand in size when
changed into upper or lower case.  This will then push characters off
the end of the string in the s3 implementation, or panic in the former
s4 implementation.

Andrew Bartlett

2 files changed, 12 insertions, 18 deletions

diff --git a/source4/ntvfs/cifs_posix_cli/svfs_util.c b/source4/ntvfs/cifs_posix_cli/svfs_util.c
index d8a7909390..128440c1ea 100644
--- a/source4/ntvfs/cifs_posix_cli/svfs_util.c
+++ b/source4/ntvfs/cifs_posix_cli/svfs_util.c
@@ -41,16 +41,15 @@ char *cifspsx_unix_path(struct ntvfs_module_context *ntvfs,
 {
 	struct cifspsx_private *p = ntvfs->private_data;
 	char *ret;
+	char *name_lower = strlower_talloc(p, name);
 
 	if (*name != '\\') {
-		ret = talloc_asprintf(req, "%s/%s", p->connectpath, name);
+		ret = talloc_asprintf(req, "%s/%s", p->connectpath, name_lower);
 	} else {
-		ret = talloc_asprintf(req, "%s%s", p->connectpath, name);
+		ret = talloc_asprintf(req, "%s%s", p->connectpath, name_lower);
 	}
 	all_string_sub(ret, "\\", "/", 0);
-
-	strlower(ret + strlen(p->connectpath));
-
+	talloc_free(name_lower);
 	return ret;
 }
 
@@ -85,9 +84,8 @@ struct cifspsx_dir *cifspsx_list_unix(TALLOC_CTX *mem_ctx, struct ntvfs_request
 	/* the wildcard pattern is the last part */
 	mask = p+1;
 
-	low_mask = talloc_strdup(mem_ctx, mask);
+	low_mask = strlower_talloc(mem_ctx, mask);
 	if (!low_mask) { return NULL; }
-	strlower(low_mask);
 
 	odir = opendir(dir->unix_dir);
 	if (!odir) { return NULL; }
@@ -102,9 +100,8 @@ struct cifspsx_dir *cifspsx_list_unix(TALLOC_CTX *mem_ctx, struct ntvfs_request
 			continue;
 		}
 
-		low_name = talloc_strdup(mem_ctx, dent->d_name);
+		low_name = strlower_talloc(mem_ctx, dent->d_name);
 		if (!low_name) { continue; }
-		strlower(low_name);
 
 		/* check it matches the wildcard pattern */
 		if (ms_fnmatch(low_mask, low_name, PROTOCOL_NT1) != 0) {
diff --git a/source4/ntvfs/simple/svfs_util.c b/source4/ntvfs/simple/svfs_util.c
index 2a01c2d5de..75261f7277 100644
--- a/source4/ntvfs/simple/svfs_util.c
+++ b/source4/ntvfs/simple/svfs_util.c
@@ -38,16 +38,15 @@ char *svfs_unix_path(struct ntvfs_module_context *ntvfs,
 {
 	struct svfs_private *p = ntvfs->private_data;
 	char *ret;
+	char *name_lower = strlower_talloc(p, name);
 
 	if (*name != '\\') {
-		ret = talloc_asprintf(req, "%s/%s", p->connectpath, name);
+		ret = talloc_asprintf(req, "%s/%s", p->connectpath, name_lower);
 	} else {
-		ret = talloc_asprintf(req, "%s%s", p->connectpath, name);
+		ret = talloc_asprintf(req, "%s%s", p->connectpath, name_lower);
 	}
 	all_string_sub(ret, "\\", "/", 0);
-
-	strlower(ret + strlen(p->connectpath));
-
+	talloc_free(name_lower);
 	return ret;
 }
 
@@ -82,9 +81,8 @@ struct svfs_dir *svfs_list_unix(TALLOC_CTX *mem_ctx, struct ntvfs_request *req,
 	/* the wildcard pattern is the last part */
 	mask = p+1;
 
-	low_mask = talloc_strdup(mem_ctx, mask);
+	low_mask = strlower_talloc(mem_ctx, mask);
 	if (!low_mask) { return NULL; }
-	strlower(low_mask);
 
 	odir = opendir(dir->unix_dir);
 	if (!odir) { return NULL; }
@@ -99,9 +97,8 @@ struct svfs_dir *svfs_list_unix(TALLOC_CTX *mem_ctx, struct ntvfs_request *req,
 			continue;
 		}
 
-		low_name = talloc_strdup(mem_ctx, dent->d_name);
+		low_name = strlower_talloc(mem_ctx, dent->d_name);
 		if (!low_name) { continue; }
-		strlower(low_name);
 
 		/* check it matches the wildcard pattern */
 		if (ms_fnmatch(low_mask, low_name, PROTOCOL_NT1) != 0) {